Database Users

[Q] Modifying stock AOSP

I have built AOSP following the Google tutorial.
I am compiling using the master branch and
Code:
aosp_grouper-userdebug
I have downloaded and extracted the appropriate proprietary binaries.
I am modifying two files from the source (see attachments; search for "// MODIFICATION ADDED HERE" to find my changes). Will these changes work? I am using Eclipse, set up in the exact way the tutorial explains, and I did not receive any errors when these changes were made.
When I compile the source using the following commands
Code:
$ . build/envsetup.sh
$ lunch aosp_grouper-userdebug
$ make fastboot adb
and flash it to my device with
Code:
$ fastboot -w flashall
BEFORE my modifications, it works just fine. The android-info.txt file and all the image files are produced properly.
However, AFTER adding the modifications, the build completes with no errors, but android-info.txt and all image files are no longer produced.
Sometimes (but, oddly, not every time) I receive a warning at the end of compilation that says the source has been modified and changes must be submitted for approval before they are official. I don't want to do that, but more importantly, why does this message not appear every time?
Why am I experiencing these problems? What can I do to make it work the way I want? Do I need to create a custom ROM with my changes? If so, how do I accomplish that? Thank you in advance for any help provided.
P.S. YES, I am aware that my modifications are not secure; these are for my own purposes, not for a public build.

Bump.

[Guide] Compiling dropbear 2015.67

Hi,
This is a guide on compiling the latest (as of 2015-06-24) dropbear SSH daemon (2015.67) for the Nexus 7 2013 but should also work for other ARM architecture Android devices. The guide is mainly based off the work from the blog http://blog.xulforum.org/index.php?post/2013/12/19/Compiling-Dropbear-for-a-Nexus-7-tablet which is an excellent guide to getting an older version of dropbear running on ARM Android devices.
I've modified the patch made by the original author to work on the latest dropbear version. There are not much changes from ver 2013.58 to 2015.67. The main difference seems to be the support for Elliptical Curve encryption.
** START DISCLAIMER **
I did not write the original codes/patch myself and have not scrutinized it for any security issues. USE IT AT YOUR OWN RISK.
** END DISCLAIMER **
Here's the list of requirements :-
1) Dropbear 2015.67 source code - dropbear-2015.67.tar.bz2 (https://matt.ucc.asn.au/dropbear/releases/dropbear-2015.67.tar.bz2)
2) Patch to compile for Android - dropbear-v67-android-patch-20150630 (https://goo.gl/Obo6kT) OR alternatively, you can use the patch from user serasihay (https://goo.gl/ip6Tkb).
3) A recent Linux distro (I use Ubuntu 14.04.2 LTS).
4) Development tools i.e. C compiler, linker, etc... all the necessary tools to run configure, make, etc..
5) Android NDK (I'm using rev 10e) installed & setup on Linux.
Steps :-
(1) Extract the source code to a directory of its own :-
Code:
tar xjf dropbear-2015.67.tar.bz2
cd dropbear-2015.67
(2) Patch the source :-
Code:
patch -p1 < dropbear-v67-android-patch-20150630
(3) Run configure :-
Code:
./configure --build=x86_64-unknown-linux-gnu --host=arm-linux-androideabi \
--disable-zlib --disable-largefile --disable-loginfunc \
--disable-shadow --disable-utmp --disable-utmpx --disable-wtmp \
--disable-wtmpx --disable-pututline --disable-pututxline --disable-lastlog
(4) Edit config.h, search for USE_DEV_PTMX and add the following line after that :-
Code:
#define USE_DEV_PTMX 1
(5) Run make :-
Code:
STATIC=1 MULTI=1 SCPPROGRESS=0 PROGRAMS="dropbear dropbearkey scp dbclient" make strip
(6) You should end up with a single static binary "dropbearmulti" which you should link dropbear, dbclient/ssh, dropbearkey and scp to.
Code:
./dropbear -h
Dropbear server v2015.67 https://matt.ucc.asn.au/dropbear/dropbear.html
Usage: ./dropbear [options]
-A Android Mode, specify a user explicitly
-N Android Mode, user name
-C Android Mode, password
-R Android Mode, public key file (authorized_keys)
-U Android Mode, UID
-G Android Mode, GID
-b bannerfile Display the contents of bannerfile before user login
(default: none)
-r keyfile Specify hostkeys (repeatable)
defaults:
dss /etc/dropbear/dropbear_dss_host_key
rsa /etc/dropbear/dropbear_rsa_host_key
ecdsa /etc/dropbear/dropbear_ecdsa_host_key
-F Don't fork into background
-E Log to stderr rather than syslog
-m Don't display the motd on login
-w Disallow root logins
-s Disable password logins
-g Disable password logins for root
-B Allow blank password logins
-j Disable local port forwarding
-k Disable remote port forwarding
-a Allow connections to forwarded ports from any host
-p [address:]port
Listen on specified tcp port (and optionally address),
up to 10 can be specified
(default port is 22 if none specified)
-P PidFile Create pid file PidFile
(default /var/run/dropbear.pid)
-i Start for inetd
-W <receive_window_buffer> (default 24576, larger may be faster, max 1MB)
-K <keepalive> (0 is never, default 0, in seconds)
-I <idle_timeout> (0 is never, default 0, in seconds)
-V Version
I will assume you know what to do with the binary file generated so will not elaborate on the process.
Hope it works for you guys. I'll be happy to help out anyone who needs more details.
NOTE: I have posted a similar guide for building dropbear for an x86 Android device in the Zenfone 2 forum (http://forum.xda-developers.com/zenfone2/general/compiling-dropbear-2015-67-zenfone-2-t3142222). The steps are mostly similar.
Cheers.
UPDATE: 2015-06-29
- I've updated the patch to fix dbclient/ssh client using password authentication.
UPDATE: 2015-06-30
- Reverted the patch for the dbclient fix as NDK does not have getpass() function. Looks like dbclient with password auth will seg fault until we can find an alternative to getpass().
UPDATE: 2015-06-30 (2)
- Uploaded yet another update to the patch to include a version of getpass(). Hopefully it works
UPDATE: 2015-07-02
- Added alternate dropbear patch by serasihay (Thanks!). Details of changes can be found here :- http://forum.xda-developers.com/showpost.php?p=61649194&postcount=14

Thank you for the guide, wolfdude!
I'm more interested in the client rather than the server, though.
Have you tried it? Does it work for you? For me, it doesn't.
I'm tying to connect to a remote host using the password authentication, but a segmentation fault occurs just after accepting the key of the remote host. It doesn't get to ask for the password.
The crosscompilation process goes without errors. I copy the binary to the Nexus, I do the symlinks in /system/xbin, etc.
I run the client from Terminal Emulator, and the remote host key is correctly stored in .ssh/known_hosts, inside the app's "app_HOME" directory found in /data.
On the remote server I can see that the connection request is received, the provided user is successfully identified as valid/existing; and the key algorithm exchange seems to succeed, too... But after that the connection is closed by the client... :-?

Hi serasihay,
Yes, I'm getting a Seg Fault too when I use the SSH client and using password auth. When I use an identity file, I don't get a SegFault and it connects successfully. I'm not sure what's causing the Seg Fault. When I get some time, I might have to run it through a debugger to find out. There might be more patches required to get the client working.
Cheers.

Thank you for confirming it, wolfdude.
I also think that there's more code to be patched.
I'm reading to learn how to debug the binary... Never done this on Android...
Thanks again for your time!

Hi Serasihay,
I've updated the patch to fix the seg fault issue. Turns out that the original patch commented out a chunk of code that was required for password authentication. Please test it out and hopefully this works well for you.
Cheers.

It looks like you've uploaded the old patch again by mistake... I diffed both files and they are exactly the same.
Yesterday I made good progress learning how to debug remotely a binary running on an Android device. I had to recompile the binary without striping the symbols, etc.
I'm a bit out of my depth here, but I'll continue trying to understand where's the flaw.
Code:
$ adb forward tcp:5039 tcp:5039
$ ./android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin/arm-linux-androideabi-gdb
[...]
(gdb) target remote :5039
(gdb) symbol-file dropbear-2015.67/dropbearmulti
Reading symbols from dropbear-2015.67/dropbearmulti...done.
(gdb) run
The "remote" target does not support "run". Try "help target" or "continue".
(gdb) continue
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0x000527cc in strlen (s=0x0) at bionic/libc/arch-arm/bionic/strlen.c:62
62 bionic/libc/arch-arm/bionic/strlen.c: No such file or directory.
(gdb) backtrace
#0 0x000527cc in strlen (s=0x0) at bionic/libc/arch-arm/bionic/strlen.c:62
#1 0x0000aff0 in cli_auth_password ()
#2 0x0000a7ec in cli_auth_try ()
#3 0x0000f534 in cli_sessionloop ()
#4 0x000161a0 in session_loop ()
#5 0x0000f16c in cli_session ()
#6 0x0000d604 in cli_main ()
#7 0x00008228 in main ()
(gdb) frame 1
#1 0x0000aff0 in cli_auth_password ()
(gdb) info frame
Stack level 1, frame at 0xbecbf848:
pc = 0xaff0 in cli_auth_password; saved pc = 0xa7ec
called by frame at 0xbecbf860, caller of frame at 0xbecbf7d0
Arglist at 0xbecbf844, args:
Locals at 0xbecbf844, Previous frame's sp is 0xbecbf848
Saved registers:
r4 at 0xbecbf834, r5 at 0xbecbf838, r6 at 0xbecbf83c, r11 at 0xbecbf840, lr at 0xbecbf844
(gdb)

I guess the code commented out in the patch that you are referring to is the one that, in cli-auth.c, does the following aasignement:
Code:
password = getpass(prompt);
It makes sense, because from the debugging "session" I posted int my previous post, one could deduce that the problem is that a null string is passed to cli_auth_password ()...
But, unhappily, the function getpass is not provided by the Android C library (Bionic). If you try to build with a "corrected" patch, you end up with this error:
Code:
cli-auth.o:cli-auth.c:function getpass_or_cancel: error: undefined reference to 'getpass'
I'll try to find a workaround. Any help will be appreciated!

serasihay said:
I guess the code commented out in the patch that you are referring to is the one that, in cli-auth.c, does the following aasignement:
...
I'll try to find a workaround. Any help will be appreciated!
Click to expand...
Click to collapse
Hi serasihay,
You're on the right track That is indeed the function causing the seg fault. I've updated the post to have the correct URL to the CORRECT patch now. Please try again and let me know how it goes.
Cheers.

Hi wolfdude,
The corrected patch you've uploaded is like the one I already tried. As I was saying in my previous post:
serasihay said:
But, unhappily, the function getpass is not provided by the Android C library (Bionic). If you try to build with a "corrected" patch, you end up with this error:
Code:
cli-auth.o:cli-auth.c:function getpass_or_cancel: error: undefined reference to 'getpass'
Click to expand...
Click to collapse
So, in my opinion, it's a matter of finding an alternative to "getpass", or implementing a new one... I'm reading what would be the better solution.
Thank you again for your time!
Cheers.

Ahh... apologies for not reading correctly. I see what you meant now. I did my compile/build on an x86 android device and I assumed that it would also work for ARM using the NDK. Let us know how you go with the getpass() alternative.
Thanks.

Hi serasihay,
Ok... I've uploaded another patch this time to include a getpass() function which I pinched & modified from the GLIBC library. Hopefully it works as expected. Again... I didn't audit it for any security issues so use at your own risk
Cheers.

Thank you very much for your help and efforts, wolfdude.
I've taken my chances with your new patch... But the code doesn't compile, either.
Now the problem is with the "getline" function:
Code:
cli-auth.o:cli-auth.c:function getpass: error: undefined reference to 'getline'
I'll keep struggling with it as time allows...
Edit:
I've found a working getpass function. The code compiles and allows me to successfuly login to my remote machine!
https://github.com/CyanogenMod/android_external_dropbear/blob/cm-12.0/netbsd_getpass.c
When I get time I'll see if it is secure to include it and what would be the proper way to do so. I'm out of my depth here. Of course, feel free to make a new patch or whatever you consider appropriate, surely you're more experienced than I am!

Good to know you have it working now. I'm no developer too so can't really comment on which ever is better. As long as it works right
Cheers.

I've uploaded the patch that makes the dropbear client work for me.
https://goo.gl/ip6Tkb
Basically, it is the one you uploaded initially, but it corrects the problem with the getpass function by using the one implemented in the file netbsd_getpass.c.
To sum it up, my patch differs from your first one in that:
* Adds two new files, netbsd_getpass.h and netbsd_getpass.c.
* Modifies cli-auth.c to include the netbsd_getpass.h in order to use its getpass function.
* Modifies the Makefile.in so that the netbsd_getpass.c object is compiled and included into the dropbearmulti binary.
* Modifies options.h to change the path of the SSH which is used in scp.c to: _PATH_SSH_PROGRAM "/system/xbin/dbclient"; i.e.: it assumes that you do the appropiate symlink in /system/xbin...
Cheers!

Good stuff! I'll update the original post to have a link to your patch.
Thanks.

I'll be happy if it helps anyone.
Thank you!

If you have openssl ported to Android, there's a simple, useful patch that substitutes crypt with openssl's DES_crypt.
Link to the description (which contains a link to the patch) is here: http://www.gossamer-threads.com/lists/openssh/bugs/55836
Note: DES encryption isn't the best, but it's better than cleartext. I did look through the openssl headers/libs for an AES_crypt or 3DES_crypt but couldn;t find anything

static compile... 'No such file or directory" error
Excellent guide -- wolfdude & serasihay thank-you. I'm new to andriod and was clueless on how to do this.
I have the dbclient running, but only if I compile without the STATIC=1. Whenever I use static I get an "sh: ./dbclient: No such file or directory" error immediately upon execution. Any idea why this is happening?
I'm using a Motorola Moto G (the new Moto G sometimes called the Moto G2). As the non-static is quite a bit smaller and seems to run okay I'm wondering if not using static will bomb on other devices and I'm just lucky with the Moto G.

Hi,
No idea why you can't compile it as static... but if the dynamic executable works for you then it should be ok.
Cheers.

I have tried to compile dropbear with both patches. But everytime it shows ::
gcc -I./libtomcrypt/src/headers/ -I. -I. -Os -W -Wall -Wno-pointer-sign -DDROPBEAR_SERVER -DDROPBEAR_CLIENT -DDBMULTI_dropbear -DDBMULTI_dbclient -DDBMULTI_dropbearkey -DDBMULTI_dropbearconvert -DDBMULTI_scp -DDROPBEAR_MULTI -c -o netbsd_getpass.o netbsd_getpass.c
netbsd_getpass.c: In function 'getpass':
netbsd_getpass.c:68:18: error: '_PASSWORD_LEN' undeclared (first use in this function)
netbsd_getpass.c:68:18: note: each undeclared identifier is reported only once for each function it appears in
netbsd_getpass.c:68:14: warning: unused variable 'buf' [-Wunused-variable]
netbsd_getpass.c:114:1: warning: control reaches end of non-void function [-Wreturn-type]
make: *** [netbsd_getpass.o] Error 1
Click to expand...
Click to collapse

Resources for Samsung Galaxy TAB A 7.0 (2016) SM-T285

I've just got a new Samsung Galaxy TAB A 7.0 LTE SM-T285, For some reason I can't seem to find any resources for this hardware yet in this forum, anyone know where I could find one? I'll try to find out if the current methods (custom recovery and root) for other tab versions work on this.
CUSTOM ROMS
============
Android 5.1.1 Lollipop (Stock)
Tinker V5 Edition based on the Samsung Stock Rom SM-T280/T285
Android 6.0 Marshmallow
Cyanogenmod 13 for the SM-T285 Only
OMNIRom for the SM-T285 Only
Android 7.1 Nougat
Cyanogenmod 14.1 for the SM-T285 Only (Experimental, things are broken, depcrated in favor of LOS 14.1)
LineageOS 14.1 for the SM-T285 Only
Other Operating systems
Porting for Sailfish OS is currently in progress for the SM-T285, stay tuned
TWRP RECOVERY AND ROOT
=======================
TWRP is available for both the T280 and T285. You should find the relevant threads in this Galaxy Tab A forum.
If you want to root stock, easiest way is to install TWRP and go for SuperSU. Please see the TWRP threads for SM-T280/T285 on how to root after TWRP is installed.
KERNEL
======
Custom kernel with working sources for the SM-T285 can be found Here
DEVELOPMENT
============
If you want to build LineageOS 14.1 on your SM-T285 LTE device, you can use this manifest, not that this is still a work in progress:
https://github.com/jedld/android.git
UPDATE 10/06/2016
================
After a couple of weeks of trial and error and tinkering, I've been able to compile a kernel for the SM-T285 from source and so far it seems to work flawlessly!
Screenshot here: http://imgur.com/a/HRgsq
link to my kernel sources here: https://github.com/jedld/kernel_samsung_gtexslte.git
You can also thank samsung for giving us a "broken by default" kernel source. I had to mix and match defconfigs from their other kernel releases just to make this thing work. Download modified boot.img here:
http://forum.xda-developers.com/galaxy-tab-a/development/kernel-galaxy-tab-7-0-2016-lte-sm-t285-t3474967
UPDATE 09/20/2016
================
This device is now ROOTED!
http://forum.xda-developers.com/galaxy-tab-a/help/resources-samsung-galaxy-tab-7-0-2016-t3431022/post68777842#post68777842
Download Pre-rooted Tinker Edition V5 in this thread: Tinker Edition Thread
Post Root Post Mortem Analysis for the SM-T285 (09/21/2016)
=========================
Q: How were you able to find root? What did you do?
A: Surprisingly the SM-T285 bootloader isn't actually locked like we thought it was (Once you OEM unlock of course and disable FRP). The bottomline is that
we simply needed patches to mkbootimg to properly package a boot image for this device as there were additional fields and sections not found on a normal boot image. There were even minor breaking difference between the tab 4 and the boot image for this device.
Q: I thought the bootloader was locked?? Why did it take so long?
A: I blame it on the really vague errors the bootloader shows when loading an improperly packaged boot image. What helped was my faith to open up a hex editor when I needed to, and really look at the stock images and the images we were making. What really pushed me to investigate further was the fact that I was able to make a really small modification to the ramdisk and use the abootimg -u update function instead of the create options.
Q: So the bootloader doesn't really check the image?
A: Yup, The bootloader doesn't do any check. I haven't checked if that is the case for the recovery partition though. Even without the SELINUXENFORCE headers at the end it still continues like other samsung devices do.
Q: So the mkbootimg patches are all that we need?
A: Yup, if you have CM, AOSP build env ready you can simply add the modified mkbootimg to system/core:
https://github.com/jedld/degas-mkbootimg/commit/b63ae38e2ab7040cc7ddaef777652a56b2e48322
Sample usage below:
Code:
degas-mkbootimg -o boot.img --base 0 --pagesize 2048 \
--kernel boot.img-zImage --cmdline "console=ttyS1,115200n8" --ramdisk boot_kitchen/boot.img-ramdisk-new.gz --dt boot.img-dt
Next challenge will be getting Cyanogenmod on this device as well as TWRP.

You won't because it has a locked bootloader, therefore not currently rootable and certainly no custom recovery.

jaritico said:
any idea to unlock bootloader?
Click to expand...
Click to collapse
Not unless Samsung provides one.

jaritico said:
any idea to unlock bootloader?
Click to expand...
Click to collapse
Probably no hope for root. the PIT, boot and recovery are basically untouchable, selinux enforcing enabled also does not help. You can still debloat and customize the system partition though:
http://forum.xda-developers.com/android/development/guide-samsung-galaxy-tab-7-0-sm-t285-t3438296
I'm working on getting CM 12.1 to run on this device.

jedld said:
Probably no hope for root. the PIT, boot and recovery are basically untouchable, selinux enforcing enabled also does not help. You can still debloat and customize the system partition though:
http://forum.xda-developers.com/android/development/guide-samsung-galaxy-tab-7-0-sm-t285-t3438296
I'm working on getting CM 12.1 to run on this device.
Click to expand...
Click to collapse
Yes at least the saving grace is that Samsung left Dm-verity off for this device.
If only they'd have left out the root restriction in the kernel too we'd have a rootable device.
I have an idea for this that I haven't tried yet.
Basically Samsung sends out security Policy updates via OTA, they recently released an SEPOLICY update to most devices breaking root. Chainfire patched this.
As this policy is stored in DATA and over rides the one in the boot.img it may be possible to use a patched SEPOLICY by creating a flashable DATA image with the patched SEPOLICY thereby removing the SElinux root restriction.
I ran it by Chainfire and he said in theory it should work except for that fact that the SEPOLICY in DATA is signed.
I have yet to try this out.
I think it would be difficult to get CM running as the kernel may need some patches and as we know that can't be touched.

ashyx said:
Yes at least the saving grace is that Samsung left Dm-verity off for this device.
If only they'd have left out the root restriction in the kernel too we'd have a rootable device.
I have an idea for this that I haven't tried yet.
Basically Samsung sends out security Policy updates via OTA, they recently released an SEPOLICY update to most devices breaking root. Chainfire patched this.
As this policy is stored in DATA and over rides the one in the boot.img it may be possible to use a patched SEPOLICY by creating a flashable DATA image with the patched SEPOLICY thereby removing the SElinux root restriction.
I ran it by Chainfire and he said in theory it should work except for that fact that the SEPOLICY in DATA is signed.
I have yet to try this out.
I think it would be difficult to get CM running as the kernel may need some patches and as we know that can't be touched.
Click to expand...
Click to collapse
I ran it by Chainfire and he said in theory it should work except for that fact that the SEPOLICY in DATA is signed.
I have yet to try this out.
Click to expand...
Click to collapse
Would probably need to brush up on se policies in linux. If there are already files available that I just need to flash over to /data I can try it out and also a means to test it if it works.

I've created a petition here:
https://www.change.org/p/samsung-unlock-the-bootloader-for-the-samsung-galaxy-tab-a-7-0-2016?recruiter=286570213&utm_source=petitions_show_components_action_panel_wrapper&utm_medium=copylink&recuruit_context=copylink_long
Not sure if samsung is the type that listens to this sort of thing though.

ashyx said:
As this policy is stored in DATA and over rides the one in the boot.img it may be possible to use a patched SEPOLICY by creating a flashable DATA image with the patched SEPOLICY thereby removing the SElinux root restriction.
I ran it by Chainfire and he said in theory it should work except for that fact that the SEPOLICY in DATA is signed.
I have yet to try this out.
Click to expand...
Click to collapse
I made an attempt to patch sepolicy using data however all I got in the logs was
Code:
E/SELinux ( 733): Function: fileToArray, File Open Unsuccessful:
E/SELinux ( 733): Function: getVersionhash, signature is NULL
I/SELinux ( 733): Function: selinux_init_verify_sepolicy, getVersionhash return false
E/SELinux ( 733): Function: VerifyPolicy , selinux_init_verify_sepolicy is failed
So far I have no indication that my patch worked
Code:
sepolicy-inject -s shell -t system -c file -p read -P sepolicy -o sepolicy
The error above only comes up if I place sepolicy in /data/security and sepolicy_version in /data/security/spota
sha256 hashes were also updated in the version file so I'm not sure what I'm missing.
If I could have a copy of a samsung ota that actually updates the policies I can probably have better direction

jedld said:
I made an attempt to patch sepolicy using data however all I got in the logs was
Code:
E/SELinux ( 733): Function: fileToArray, File Open Unsuccessful:
E/SELinux ( 733): Function: getVersionhash, signature is NULL
I/SELinux ( 733): Function: selinux_init_verify_sepolicy, getVersionhash return false
E/SELinux ( 733): Function: VerifyPolicy , selinux_init_verify_sepolicy is failed
So far I have no indication that my patch worked
Code:
sepolicy-inject -s shell -t system -c file -p read -P sepolicy -o sepolicy
The error above only comes up if I place sepolicy in /data/security and sepolicy_version in /data/security/spota
sha256 hashes were also updated in the version file so I'm not sure what I'm missing.
If I could have a copy of a samsung ota that actually updates the policies I can probably have better direction
Click to expand...
Click to collapse
Finally found a way to patch the kernel on this device. Stay tuned...

jedld said:
Finally found a way to patch the kernel on this device. Stay tuned...
Click to expand...
Click to collapse
Turns out I was just able to modify files in the boot.img, though when I try to update the sepolicy itself, it won't boot.

jedld said:
Turns out I was just able to modify files in the boot.img, though when I try to update the sepolicy itself, it won't boot.
Click to expand...
Click to collapse
Can you at least explain a bit further?
What modifications allow you to create a boot able image?
How have you overcome image signing?
Only way I can think of is hex editing the signature, however I was under the impression this was crc based.

ashyx said:
Can you at least explain a bit further?
What modifications allow you to create a boot able image?
How have you overcome image signing?
Only way I can think of is hex editing the signature, however I was under the impression this was crc based.
Click to expand...
Click to collapse
Yeah I was able to flash a modified boot.img using heimdall, turns out that you just need to use abootimg -u boot.img -r yourmodifiedramdisk so that you don't overwrite the SELINUXENFORCE headers appended at the end of the boot.img file, it appears the bootloader only checks for the presence of those headers but does not actually compute the sig.
Modifying ramdisk works, haven't tried modifying the kernel itself.

I tried to modify the sepolicy files after using sepolicy-inject but it throws a KERNEL not SEnforced error. I am not certain if this is just a blanket error if the kernel doesn't boot due to modifying the policy files incorrectly or if there is legit checking going on. Nevertheless I am able to modify the init.rc files now.

jedld said:
I tried to modify the sepolicy files after using sepolicy-inject but it throws a KERNEL not SEnforced error. I am not certain if this is just a blanket error if the kernel doesn't boot due to modifying the policy files incorrectly or if there is legit checking going on. Nevertheless I am able to modify the init.rc files now.
Click to expand...
Click to collapse
Continued checking it out. So even though I can modify the ramdisk, I am unable to add more than 1000 - 2000 bytes before setting off the SEAndroid enforce error on bootup. Might be some headers on the boot.img that I fail to update when the ramdisk size gets bigger. Trying to modify the sepolicy in any way even if there is minimal change in size prevents it from booting. I have no idea what is checking it, I'll try to hexedit and see what happens.

jedld said:
Continued checking it out. So even though I can modify the ramdisk, I am unable to add more than 1000 - 2000 bytes before setting off the SEAndroid enforce error on bootup. Might be some headers on the boot.img that I fail to update when the ramdisk size gets bigger. Trying to modify the sepolicy in any way even if there is minimal change in size prevents it from booting. I have no idea what is checking it, I'll try to hexedit and see what happens.
Click to expand...
Click to collapse
So I used a hexedit on the sepolicy file and was able to modify one byte of it effectively changing its sha256sum... and it worked. So the sepolicy file CAN be changed, however current sepolicy-inject and supolicy tools does something to it that trips it, looks like samsung has again added a proprietary modification sepolicy format.

I've never known a kernel not boot due to the kernel not SEANDROID enforcing warning.
It's a meaningless warning and easily bypassed.
However this is on bootloader unlocked devices.
So just let me get this straight, you have been able to repack the boot.img with modifications to the ramdisk then force flash it via Heimdall and it still boots?

ashyx said:
I've never known a kernel not boot due to the kernel not SEANDROID enforcing warning.
It's a meaningless warning and easily bypassed.
However this is on bootloader unlocked devices.
So just let me get this straight, you have been able to repack the boot.img with modifications to the ramdisk then force flash it via Heimdall and it still boots?
Click to expand...
Click to collapse
yup. that's correct. I'll post my modified boot.img in a while

jedld said:
yup. that's correct. I'll post my modified boot.img in a while
Click to expand...
Click to collapse
note that using the update only method of abootimg "abootimg -u boot.img -r xxxxxx " is the only one that works for repacking the ramdisk. Trying to build the boot.img from scratch using any other method has so far failed for me.

Here is a flashable boot.img for the SM-T285.
It contains the following modifications to the ramdisk:
a file at /this_device_is_owned
and a modified init.rc that creates a /tmp folder

jedld said:
Here is a flashable boot.img for the SM-T285.
It contains the following modifications to the ramdisk:
a file at /this_device_is_owned
and a modified init.rc that creates a /tmp folder
Click to expand...
Click to collapse
now managed to patch sepolicy using chainfire's supolicy tool. needed to use a customized mkbootimg due to changes in the Tab A image format for this. now attempting to root the device... wish me luck

[Guide][Root] How to install the latest Google software update

This guide is primarily intended for rooted users updating to the latest security update, since stock users can just take the OTA.
Key points
User data and applications are kept intact
You do not have to remove your PIN, password, or fingerprint
You do not have to remove TWRP, Magisk, your custom kernel, dtbo, or anything
This is intended for monthly security updates; developer previews and beta releases may or may not work with this method. You're welcome to try, but all may not work as expected
Installing Update:
Make sure you have the latest Google SDK Platform Tools. Extract the archive to a location of your choosing (creates platform-tools folder)
Get the latest taimen Factory Image (not OTA) from Google's Developer Page and save to a location of your choosing
Extract the archive, and open the extracted folder. You should see a list of files:
bootloader-taimen-[version string].img
flash-all.bat
flash-all.sh
flash-base.sh
image-taimen-[version string].zip
radio-taimen-[version string]
.img
Open the flash-all script (flash-all.bat for Windows, flash-all.sh for Linux/OSX) in your favorite text editor.
Find the line that reads "fastboot -w update image-taimen-[version].zip and remove "-w" (the wipe user data switch). Save and close the flash-all script.
Move (cut and paste, etc) all of these files to the platform-tools folder.
Enable USB Debugging from the Developer Options menu on your device (press "Build Number" 7 times if not already visible)
With your device plugged into the computer, open a command prompt in the platform-tools folder
Windows: Open the folder, hold down Shift and right click inside the folder, "Open Command window here"
Linux: If you're on Linux you already know how to do this
OSX: Open a folder in a terminal
Reboot to bootloader:
Code:
adb reboot bootloader
Execute update script in terminal:
Windows:
Code:
flash-all.bat
Linux/OSX:
Code:
./flash-all.sh
The device will reboot a few times while updating
Restoring root and/or a custom recovery
Download latest:
TWRP image
Magisk zip
TWRP zip
(Optional) Custom kernel zip
Place all files in the platform-tools folder
Reboot to bootloader
Boot TWRP image.
Code:
fastboot boot [twrp image filename].img
Push zip files to /tmp
Code:
adb push [magisk filename].zip /tmp
Optional: TWRP persistent installation + custom kernel:
Code:
adb push [twrp filename].zip /tmp
adb push [custom kernel filename].zip /tmp
Install Magisk:
Code:
adb shell twrp install /tmp/[magisk filename].zip
Optional: TWRP persistent installation + custom kernel:
Code:
adb shell twrp install /tmp/[twrp filename].zip
adb shell twrp install /tmp/[custom kernel filename].zip
adb shell twrp install /tmp/[magisk filename].zip
Reboot to system

[ Reserved ]

[ Reserved Post ]

[Deleted]

tlbland0426 said:
Nice guide but correct me if I'm wrong but I don't believe there is a working solution for Magisk yet
Click to expand...
Click to collapse
Magisk works fine...

twiz0r said:
Magisk works fine...
Click to expand...
Click to collapse
He probably was referring to P

Telperion said:
This guide is primarily intended for rooted users updating to the latest security update, since stock users can just take the OTA.
Key points
User data and applications are kept intact
You do not have to remove your PIN, password, or fingerprint
This is intended for monthly security updates; developer previews and beta releases may not work as expected
Installing Update:
Make sure you have the latest Google SDK Platform Tools. Extract the archive to a location of your choosing (creates platform-tools folder)
Get the latest taimen Factory Image from Google's Developer Page and save to a location of your choosing
Extract the archive, and open the extracted folder. You should see a list of files: bootloader-taimen-[version string].img/B]
flash-all.bat
flash-all.sh
flash-base.sh
image-taimen-[version string].zip
radio-taimen-[version string]
.img
Open the flash-all script (flash-all.bat for Windows, flash-all.sh for Linux/OSX) in your favorite text editor.
Find the line that reads "fastboot -w update image-taimen-[version].zip and remove "-w" (the wipe user data switch). Save and close the flash-all script.
Move (cut and paste, etc) all of these files to the platform-tools folder.
Enable USB Debugging from the Developer Options menu on your device (press "Build Number" 7 times if not already visible)
With your device plugged into the computer, open a command prompt in the platform-tools folder
Windows: Open the folder, hold down Shift and right click inside the folder, "Open Command window here"
Linux: If you're on Linux you already know how to do this
OSX: Open a folder in a terminal
Reboot to bootloader:
Execute update script in terminal:
Windows:
Linux/OSX:
The device will reboot a few times while updating
Restoring root and/or a custom recovery
Download latest:
TWRP image
Magisk zip
TWRP zip
(Optional) Custom kernel zip
Place all files in the platform-tools folder
Reboot to bootloader
Boot TWRP image.
Note: As of the February security update, TWRP 3.2.1-0 cannot decrypt the /data/ partition. When prompted for your PIN, cancel. You can keep /system/ read-only.
Push zip files to /tmp
Optional: TWRP persistent installation + custom kernel:
Install Magisk:
Optional: TWRP persistent installation + custom kernel:
Reboot to system
Click to expand...
Click to collapse
Will this method work if I already have TWRP installed or is this for people who have the factory recovery? I understand that I'll have to reinstall TWRP after. I just wanna make sure that this will work with TWRP installed before I do it. Thanks for the great tutorial btw!
Update: Guide worked perfectly for me!

I would say the guide worked perfectly, but even after removing the "-w", my phone immediately proceeded to wipe all data anyway.
HOWEVER!: This may have been personal error as the first time I did the "flash-all" bat, I forgot to "unlock_critical" (perhaps you should add this to your guide as mine seemed to have reset itself). I therefore had to flash again, which may have caused a corrupted file and automatically initiated the system wipe.
Secondly, on the first boot/install of TWRP, I would not recommend flashing absolutely everything in one go as for me it borked the install of Magisk and caused me all sorts of issues with Google Play (no idea how, but it did).
I would only suggest booting to TWRP and installing that zip, then going back into recovery afterwards and then flashing your kernel, then finally flashing Magisk (may be an issue related to my kernel and Magisk overwriting each other?).
Then go back into TWRP a final time and flash Dolby/VIPER, etc...

Eleiyas said:
I would say the guide worked perfectly, but even after removing the "-w", my phone immediately proceeded to wipe all data anyway.
HOWEVER!: This may have been personal error as the first time I did the "flash-all" bat, I forgot to "unlock_critical" (perhaps you should add this to your guide as mine seemed to have reset itself). I therefore had to flash again, which may have caused a corrupted file and automatically initiated the system wipe.
Secondly, on the first boot/install of TWRP, I would not recommend flashing absolutely everything in one go as for me it borked the install of Magisk and caused me all sorts of issues with Google Play (no idea how, but it did).
I would only suggest booting to TWRP and installing that zip, then going back into recovery afterwards and then flashing your kernel, then finally flashing Magisk (may be an issue related to my kernel and Magisk overwriting each other?).
Then go back into TWRP a final time and flash Dolby/VIPER, etc...
Click to expand...
Click to collapse
Well once you issues the "unlock_critical" it was wiped right?

Hey guys, I followed this today and it wiped data. I am not sure if Google has changed the flash-all.bat file, but I do recall in the past following these exact steps, opening the flash-all.bat, removing "-w" and that saving the data.
Today though, when I opened the bat for image (8.1.0 (OPM2.171019.029.B1, May 2018)) here's what it says: @Echo off
:: Copyright 2012 The Android Open Source Project
::
:: Licensed under the Apache License, Version 2.0 (the "License");
:: you may not use this file except in compliance with the License.
:: You may obtain a copy of the License at
::
:: http://www.apache.org/licenses/LICENSE-2.0
::
:: Unless required by applicable law or agreed to in writing, software
:: distributed under the License is distributed on an "AS IS" BASIS,
:: WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
:: See the License for the specific language governing permissions and
:: limitations under the License.
PATH=%PATH%;"%SYSTEMROOT%\System32"
fastboot flash bootloader bootloader-taimen-tmz12a.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash radio radio-taimen-g8998-00164-1710262031.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot update image-taimen-opm1.171019.011.zip
echo Press any key to exit...
pause >nul
exit
//////////////////
So there's no -w there by default apparently. When I didn't see it I assumed I would be alright. Not the case lol. But thankfully I had already backed up the few things that mattered so it wasn't a huge deal but nevertheless, is there something i am missing for future reference?

Teffy said:
Hey guys, I followed this today and it wiped data. I am not sure if Google has changed the flash-all.bat file, but I do recall in the past following these exact steps, opening the flash-all.bat, removing "-w" and that saving the data.
Today though, when I opened the bat for image (8.1.0 (OPM2.171019.029.B1, May 2018)) here's what it says: @Echo off
:: Copyright 2012 The Android Open Source Project
::
:: Licensed under the Apache License, Version 2.0 (the "License");
:: you may not use this file except in compliance with the License.
:: You may obtain a copy of the License at
::
:: http://www.apache.org/licenses/LICENSE-2.0
::
:: Unless required by applicable law or agreed to in writing, software
:: distributed under the License is distributed on an "AS IS" BASIS,
:: WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
:: See the License for the specific language governing permissions and
:: limitations under the License.
PATH=%PATH%;"%SYSTEMROOT%\System32"
fastboot flash bootloader bootloader-taimen-tmz12a.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash radio radio-taimen-g8998-00164-1710262031.img
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot update image-taimen-opm1.171019.011.zip
echo Press any key to exit...
pause >nul
exit
//////////////////
So there's no -w there by default apparently. When I didn't see it I assumed I would be alright. Not the case lol. But thankfully I had already backed up the few things that mattered so it wasn't a huge deal but nevertheless, is there something i am missing for future reference?
Click to expand...
Click to collapse
Did this occur when you tried to edit the flash-all.bat file? If so, how were you trying to edit the file?

Badger50 said:
Did this occur when you tried to edit the flash-all.bat file? If so, how were you trying to edit the file?
Click to expand...
Click to collapse
I'm not sure if you're confused about what I wrote so I'll recap. I edited the flashall with notepad but remember I never ended up changing anything at all because the file did not contain "-w" on first open after extraction.
So essentially, I did all the steps except when I editted the flash-all I didn't actually have to edit anything because there was no -w (I included full text as is, first open in my post). Then I continued through rest of the steps. Everything worked fine other than it did wipe use data at the very end.

Teffy said:
I'm not sure if you're confused about what I wrote so I'll recap. I edited the flashall with notepad but remember I never ended up changing anything at all because the file did not contain "-w" on first open after extraction.
So essentially, I did all the steps except when I editted the flash-all I didn't actually have to edit anything because there was no -w (I included full text as is, first open in my post). Then I continued through rest of the steps. Everything worked fine other than it did wipe use data at the very end.
Click to expand...
Click to collapse
I'm always confused my friend. I got it now That's pretty weird for sure. Never encountered that with all the factory images since November. Must have been a rouge download or something. I'll be on the lookout for it though in the coming months :good::good:

Can anyone confirm if this process still works on the June update?
Thanks

docluv01 said:
Can anyone confirm if this process still works on the June update?
Thanks
Click to expand...
Click to collapse
Don't see why not. It's pretty much the same as the one I use :good:

docluv01 said:
Can anyone confirm if this process still works on the June update?
Thanks
Click to expand...
Click to collapse
It worked when I flashed a device from May to Beta 2 this week, so June should still work.

My June factory flash all. bat still had the - w in it. I removed - w, saved it, ran it and worked fine. My Substratum black theme for Inbox still works as well. No data wiped at all.

If I use this method to update, is it just "dirty flashing" the device? So all my settings, apps and their data and the internal storage will remain intact? If not it's better just to flash the full OTA zip as it was suggested for me in another thread by @Badger50 ?

matekaneve said:
If I use this method to update, is it just "dirty flashing" the device? So all my settings, apps and their data and the internal storage will remain intact? If not it's better just to flash the full OTA zip as it was suggested for me in another thread by @Badger50 ?
Click to expand...
Click to collapse
Either way, your data will not be wiped. Google dirty OTA's stock, non rooted folks every month ??

Windows 10. Shift, right click menu has powershell instead of cmd.exe. Powershell doesn't work well for this. Someone tipped me to typing cmd into the path window of file explorer to get the cmd prompt going. Much easier to use than that powershell stuff.

[HOW-TO] Building TWRP from source with goodies

I decided to put together a guide on how to build TWRP from source, having successfully built it myself and restored a few of the goodies that disappeared in the 3.3.1-0 release (e.g. install kernel). Also, marlin (Pixel XL) has had a few advancements over sailfish (Pixel), so this is a way to get back on par even if unofficially.
Whilst I'll go into a good level of detail, this will not be a hand-holding guide. You are expected to be able to use the Linux command line, and tools such as Git and repo.
Download sources
This guide is based upon building from the Minimal TWRP sources, which are based upon a subset of Omnirom. At the time of writing, the latest branch is twrp-9.0 (Pie). (If you are reading this some months after I have written this guide, check for later branches.) Follow this link for the repo, and the instructions:
https://github.com/minimal-manifest-twrp/platform_manifest_twrp_omni/tree/twrp-9.0
Firstly, create a folder to put this in, e.g. $HOME/twrp-minimal-omni, and change to that directory. Then execute the following for a shallow clone (to save space...):
Code:
repo init --depth=1 -u git://github.com/minimal-manifest-twrp/platform_manifest_twrp_omni.git -b twrp-9.0
Before doing the repo sync, we will need a few extra repositories to be downloaded. Create a subfolder .repo/local_manifests and create an XML file (e.g. custom.xml) with the following content:
Code:
<?xml version="1.0" encoding="UTF-8"?>
<manifest>
<project name="android_device_google_marlin" path="device/google/marlin" remote="TeamWin" revision="android-9.0" />
<project path="hardware/qcom/bootctrl" name="platform/hardware/qcom/bootctrl" groups="pdk-qcom" remote="aosp" />
<project path="hardware/qcom/msm8998" name="platform/hardware/qcom/msm8998" groups="qcom_msm8998,pdk-qcom" remote="aosp" />
</manifest>
android_device_google_marlin - contains the configuration and build instructions for marlin and sailfish
hardware/qcom/bootctrl - this is part of AOSP, and is required for building TWRP
hardware/qcom/msm8998 - extra chipset stuff that is required for marlin/sailfish
You can do a repo sync now to download the sources.
Additionally, we will need some driver binaries that are available from Google. Get the Google (Qcom is not necessary) drivers for the latest Pie release here:
https://developers.google.com/android/drivers#sailfishpq3a.190801.002
Extract the files into the same folder as you created, and execute e.g as follows, and follow the prompts:
Code:
./extract-google_devices-sailfish.sh
The binaries will be extracted into a vendor/google-devices/ sub-folder. Do not rename the sub-folder - the configuration looks for exactly this path.
You now have all of the source files needed.
Do the build
We then more-or-less follow the instructions as per the original minimal manifest page:
Code:
export ALLOW_MISSING_DEPENDENCIES=true
. build/envsetup.sh
lunch omni_sailfish-eng
mka bootimage
The boot image will be created at out/target/product/sailfish/boot.img.
Use fastboot boot out/target/product/sailfish/boot.img to test it in fastboot mode on your device.
Hope this helps someone out there!
XDA:DevDB Information
Building TWRP for Sailfish, Tool/Utility for the Google Pixel
Contributors
NZedPred
Version Information
Status: Stable
Created 2020-01-03
Last Updated 2020-04-26

Downloads
Occasionally I will make available one of my builds. They will be in the folders below.
Please note the following:
You are always encouraged to use the official versions of TWRP instead of these
I am not liable for anything that goes wrong as a consequence of using them
As a general rule, I will not be fixing bugs or adding features to these builds (other than enabling features that already are in the code) - they are built straight from the TWRP sources
Google Pixel (Sailfish) Unofficial TWRP
Google Pixel (Marlin) XL Unofficial TWRP
GPL compliance
The downloads in this folder use pre-compiled Linux kernels. The source for these can be found here (thanks to @razorloves for pointing out the correct URL):
[URL="https://github.com/bigbiff/android_kernel_google_marlin/commits/lineage-16.0[/URL]
Refer to the tags/branches prefixed with "android-msm-marlin-".
Log
20200301 - Added version "3.3.1-4-experimental-multi-user-decrypt" for Sailfish and Marlin, ability to decrypt data for multiple users. Refer to the advanced menu.
20200223 - Added version string "3.3.1-3-unofficial-nzedpred" for Sailfish, very minor updates from TWRP
20200115 - Added a build of OrangeFox Recovery for Sailfish
20200105 - Added f2fs support (consider the f2fs option to be experimental, and it may not even work)
20200104 - Initial version for sailfish with feature parity with marlin

Building other recoveries - Orangefox
Orangefox
Quick guide for the impatient
Create a folder that will be your OrangeFox folder, and change into it. All commands below will be relative to this folder.
Code:
# Initialize the repo
repo init --depth=1 -u https://gitlab.com/OrangeFox/Manifest.git -b fox_9.0
# Create local manifests folder
mkdir .repo/local_manifests
# Create the local manifest for sailfish/marlin - use gedit, kate, leafpad, whatever your text editor is
gedit .repo/local_manifests/orangefox-marlin.xml
After the last command, the text editor window will open. Paste the following content into it.
Code:
<?xml version="1.0" encoding="UTF-8"?>
<manifest>
<remote name="TeamWin" fetch="https://github.com/TeamWin" review="https://gerrit.twrp.me" />
<project name="external_magisk-prebuilt" path="external/magisk-prebuilt" remote="TeamWin" revision="master" />
<project name="android_device_google_marlin" path="device/google/marlin" remote="TeamWin" revision="android-9.0" />
<project path="hardware/qcom/bootctrl" name="platform/hardware/qcom/bootctrl" groups="pdk-qcom" remote="aosp" />
<project path="hardware/qcom/msm8998" name="platform/hardware/qcom/msm8998" groups="qcom_msm8998,pdk-qcom" remote="aosp" />
</manifest>
Then save and close the editor, and continue with the following commands.
Code:
# Sync the repos
repo sync -j8
Additionally, we will need some driver binaries that are available from Google. Get the Google (Qcom aren't necessary) drivers for the latest Pie release here:
https://developers.google.com/android/drivers#sailfishpq3a.190801.002
Extract the files into the same folder as you created, and execute as follows, and follow the prompts:
Code:
./extract-google_devices-sailfish.sh
The binaries will be extracted into a vendor/google-devices/ sub-folder. Do not rename the sub-folder - the configuration looks for exactly this path.
You now have all of the source files needed.
At the time of writing, there is a bug that prevents the FB2PNG module building (I think this is FrameBuffer2PNG - screenshots). Edit the file as below
Code:
# Edit sailfish config
gedit device/google/marlin/sailfish/BoardConfig.mk
# Edit marlin config
gedit device/google/marlin/marlin/BoardConfig.mk
Around line 204, change
Code:
TW_INCLUDE_FB2PNG := [U]true[/U]
to
Code:
TW_INCLUDE_FB2PNG := [U]false[/U]
Now continue to build as normal
Code:
. build/envsetup.sh
export ALLOW_MISSING_DEPENDENCIES=true
# For building sailfish use this line
lunch omni_sailfish-eng
# For building marlin use this line
lunch omni_marlin-eng
mka bootimage
NOTE: If you are building for sailfish, don't run the lunch omni_marlin-eng line. Also, you may get an error "Your device can't be found in device sources..". That's actually OK, it's just because there isn't a folder called device/google/sailfish. If the error bothers you, just create the folder and re-run the lunch command (and ignore the warning about device/google/sailfish/omni.dependencies file not found).
This will create a fastboot bootable image in the $OUT folder called boot.img. You can try booting it with your device in fastboot mode:
Code:
fastboot boot $OUT/boot.img
There are also a number of environment variables that OrangeFox has available. I haven't really tested whether or not they are necessary. Will update this post after I do some investigation.

Could you make twrp for marlin with support F2FS? I did but unsuccesed.

chuate92 said:
Could you make twrp for marlin with support F2FS? I did but unsuccesed.
Click to expand...
Click to collapse
You will need to add a flag to the device/google/marlin/marlin/BoardConfig.mk file:
Code:
TARGET_USERIMAGES_USE_F2FS := true
Additionally, the kernel needs to support f2fs. No idea if the one that comes with the repos supports it, but you could always grab one from a kernel that does and try that.
I'll try doing a build later on, but you will have to test at your own risk.

NZedPred said:
You will need to add a flag to the device/google/marlin/marlin/BoardConfig.mk file:
Code:
TARGET_USERIMAGES_USE_F2FS := true
Additionally, the kernel needs to support f2fs. No idea if the one that comes with the repos supports it, but you could always grab one from a kernel that does and try that.
I'll try doing a build later on, but you will have to test at your own risk.
Click to expand...
Click to collapse
I followed your guide but, I didn't know how to do "Create a subfolder .repo/local_manifests and create an XML file (e.g. custom.xml) with the following content:". So I downloaded manual. Then I do build recoveryimage, I still got error them same I posted here https://forum.xda-developers.com/showthread.php?p=81384609#post81384609.
I didn't know why.

chuate92 said:
I followed your guide but, I didn't know how to do "Create a subfolder .repo/local_manifests and create an XML file (e.g. custom.xml) with the following content:". So I downloaded manual. Then I do build recoveryimage, I still got error them same I posted here https://forum.xda-developers.com/showthread.php?p=81384609#post81384609.
I didn't know why.
Click to expand...
Click to collapse
For the above, using the command line, from the folder you originally created you do this:
Code:
mkdir .repo/local_manifests
gedit .repo/local_manifests/custom.xml
If you don't have gedit, use e.g. kate, or whatever other text editor you have.
Also, you don't build a recovery image - you build a boot image.
Code:
mka bootimage
Anyway, I've updated the second post with a folder for Google Pixel XL as well. I'll upload there later (once AFH sorts itself out - I can't upload anything into the new folder yet).
For now, try using the build here (at your own risk):
https://www.dropbox.com/s/gvkvhklmu2fh0tx/twrp-marlin-unofficial-20200105.img?dl=0

tried this unofficial twrp for sailfish. it boots just fine as temporary recovery, when trying to install into ramDisk it acts as the official image, too large to fit the ramDisk

wizardwiz said:
tried this unofficial twrp for sailfish. it boots just fine as temporary recovery, when trying to install into ramDisk it acts as the official image, too large to fit the ramDisk
Click to expand...
Click to collapse
Yes, TWRP is now getting quite big and a lot of features would have to be removed to get it to fit into the ramdisk. This is something I've been spending some time on, but it seems to be a difficult ask at this point. I'll post if I ever get there...

I'm having some trouble with your guide. I am trying to compile not TWRP but orangefox recovery. I have the files and I will link them below. If you could either walk me through building orangefox or building it yourself, that would be amazing. I have a sailfish.
Link: https://gitlab.com/OrangeFox/Recovery

Spookybear said:
I'm having some trouble with your guide. I am trying to compile not TWRP but orangefox recovery. I have the files and I will link them below. If you could either walk me through building orangefox or building it yourself, that would be amazing. I have a sailfish.
Link: https://gitlab.com/OrangeFox/Recovery
Click to expand...
Click to collapse
I've had a look at this, and I don't think it's as straight forward as merely dropping in in the TWRP sailfish device tree and building. It reports success when building, but it hasn't actually built anything...
I'd suggest you go to their Telegram chat for building OrangeFox: https://t.me/OrangeFoxBuilding

@Spookybear - I managed to do a build. If you want to test (at your own risk!) you can get it here:
https://www.androidfilehost.com/?fid=4349826312261701399

@Spookybear - I managed to do a build. If you want to test (at your own risk!) you can get it here:
https://www.androidfilehost.com/?fid=4349826312261701399

NZedPred said:
@Spookybear - I managed to do a build. If you want to test (at your own risk!) you can get it here:
https://www.androidfilehost.com/?fid=4349826312261701399
Click to expand...
Click to collapse
Can you send me the zip file of your build environment, I'm getting ninja error 1. Thank you.

NZedPred said:
@Spookybear - I managed to do a build. If you want to test (at your own risk!) you can get it here:
https://www.androidfilehost.com/?fid=4349826312261701399
Click to expand...
Click to collapse
tested it. Working just fine. to bad it is based on twrp 3.3.1 (naturally) and therefor still to large to fit the RamDisk.

wizardwiz said:
tested it. Working just fine. to bad it is based on twrp 3.3.1 (naturally) and therefor still to large to fit the RamDisk.
Click to expand...
Click to collapse
I meant that you could compress your /scripts folder and so I could try to build different versions for when it gets updated or when I need to fix a bug.
Thank you

Spookybear said:
I meant that you could compress your /scripts folder and so I could try to build different versions for when it gets updated or when I need to fix a bug.
Thank you
Click to expand...
Click to collapse
I'll add a guide into the third post of this thread for it. It's a bit much trying to compress some 40GB of files. Best you use the guide and try to work out where things went wrong. Will update once its up.
Quick and dirty guide to compiling OrangeFox now up

NZedPred said:
I'll add a guide into the third post of this thread for it. It's a bit much trying to compress some 40GB of files. Best you use the guide and try to work out where things went wrong. Will update once its up.
Quick and dirty guide to compiling OrangeFox now up
Click to expand...
Click to collapse
Thank you, I will work on this later.

NZedPred said:
I'll add a guide into the third post of this thread for it. It's a bit much trying to compress some 40GB of files. Best you use the guide and try to work out where things went wrong. Will update once its up.
Quick and dirty guide to compiling OrangeFox now up
Click to expand...
Click to collapse
Thank you, it worked.

Is it possible to merge this patch into your build? It should fix the issue when doing multi-user backup. Thanks.
https://gerrit.omnirom.org/c/android_bootable_recovery/+/33944